A New Accountability Layer — or a Surveillance Tether?
When President Ferdinand Marcos Jr. signed the SIM Card Registration Act (Republic Act No. 11934) into law in October 2022, the stated rationale was narrow: end the era of untraceable prepaid SIM cards exploited by SMS scammers and fraudsters. The law required biometric or documentary verification before SIM activation. By July 2023, when the registration deadline passed, roughly 54 million unregistered cards had been deactivated. Regulators and telecoms hailed the achievement as a victory against anonymous crime.
What received far less scrutiny was a quieter transformation: the Philippines had just created a real-name infrastructure for mobile communications at precisely the moment when cyberlibel — criminal defamation via digital platforms — was entrenching itself as the country's most-prosecuted online offense.
Cyberlibel: A Prosecution Favourite
Under Republic Act No. 10175, the Cybercrime Prevention Act of 2012, online libel is defined as defamation committed through information and communications technology. The Supreme Court upheld its constitutionality in Disini v. Secretary of Justice (2014), while also striking down provisions for warrantless real-time data collection and invalidating aiding-and-abetting liability — drawing the law's outer bounds around original authors and publishers.
Within those bounds, cyberlibel has become the dominant category of cybercrime in the Philippines. The Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC) confirm that online libel led all nine tracked cybercrime categories in reported complaints through 2025. Total cybercrime incidents fell 38% in 2025 — to 8,987 cases from 14,529 in 2024 — but cyberlibel consistently drove the caseload. From November 2024 to October 2025 alone, 2,933 cases were filed in court, yielding 252 convictions and 1,068 cybercrime warrants served.
The penalties are steep. Cyberlibel carries imprisonment of approximately two years and four months to six years — one degree higher than traditional libel under the Revised Penal Code, a premium applied because the ICT medium is treated as an aggravating circumstance. In April 2025, Governor Manuel Mamba of Cagayan Province was convicted and sentenced to an indeterminate term of four to six years for comments made during an online radio programme in 2020. Freedom House rated the Philippines 61 out of 100 — "Partly Free" — in its 2025 Freedom on the Net index, citing repeated cyberlibel prosecutions affecting journalists, elected officials, and ordinary citizens alike.
How SIM Registration Changes the Enforcement Calculus
Before RA 11934, a prepaid SIM bought at a convenience store could fuel an anonymous social media account with no linkage to a real identity. The SIM registration law closed that gap — imperfectly, as IT experts and the Computer Professionals' Union have documented, since fraudulent IDs and SIM resale remain workarounds — but substantively enough to change what investigators can request.
RA 11934 permits disclosure of subscriber data through subpoena or court order, and in compliance with other laws obligating telcos to disclose. That language is broad enough to encompass cyberlibel investigations under RA 10175. The chain now runs: social media post → cyberlibel complaint → subpoena to telco → subscriber record linked to a registered SIM. What was previously a multi-step investigative challenge has a cleaner, faster path.
The National Privacy Commission (NPC) convened with major telecommunications companies in December 2022 specifically to discuss data privacy safeguards under the new SIM registration framework. The NPC operates under the Data Privacy Act of 2012 (RA 10173) and has continued issuing substantive guidance — most recently Advisory No. 2026-01 in early 2026, which confirmed that publicly available personal data remains fully subject to DPA protections and requires valid lawful bases for processing. But the NPC's authority stops where a lawfully issued judicial subpoena begins. It cannot block court-ordered subscriber disclosure; it can only set processing standards for the data itself.
The Steelman for the Current Framework
The strongest case for the existing architecture runs like this: anonymous online communications genuinely enable real harm — from mass SMS fraud to coordinated harassment campaigns. The Disini ruling drew a careful line, protecting readers and sharers while holding original authors accountable for deliberate publications. Some form of identity accountability for serious defamation is consistent with international practice; no major democratic legal system treats speech as wholly consequence-free.
That argument has merit, but it fails the proportionality test. Criminal cyberlibel — carrying mandatory imprisonment for what is often a dispute between private parties — is a disproportionate instrument. The Commission on Human Rights (CHR) noted in January 2026 that criminal libel cases reaching higher courts disproportionately involve powerful individuals using prosecutions strategically against critics. The mechanism is the threat of arrest and trial, not the eventual conviction: a Strategic Lawsuit Against Public Participation does its silencing work before any verdict is rendered.
The Reform Moment
Senate Bill No. 250, filed in 2025 by Sen. Erwin Tulfo, proposes the proportionate alternative: replace criminal penalties with civil liability for libel and cyberlibel. Victims of genuine defamation could still seek damages through the courts; what they could no longer do is use the prospect of imprisonment to silence critics pre-trial. The CHR formally endorsed decriminalization in early 2026, and a growing body of legal commentary — including a detailed April 2026 analysis by ACCRALAW — describes Senate Bill No. 250 as the third formal decriminalization attempt since 2012, suggesting that opposition is institutional inertia rather than principled disagreement.
The Necessary Decoupling
Evidence-based policy points to two parallel corrections. First, decriminalize cyberlibel. Civil damages provide accountability without the chilling effect of criminal prosecution and more appropriately calibrate consequences to actual harm. Second, tighten RA 11934's data access standards — judicial review should require explicit proportionality analysis before telco subscriber records flow to cybercrime investigators, not merely a standard subpoena. The NPC should be given explicit authority to audit compliance with those standards.
The combination of SIM registration and criminal cyberlibel was not designed as a speech-surveillance apparatus. But policy is evaluated by effect, not intent. A framework that systematically links online identities to real persons and then criminalises online expression with prison time is a chilling-effect machine, whatever its architects intended. The current Congress has the tools to decouple these two levers. How it uses them will define whether the Philippines' digital rights trajectory turns toward proportionality — or away from it.